'==============================================================================
' LANG		: VBScript 
' NAME		: FCS-SampleScript Uninstall McAfee AV.vbs 
' VERSION	: 2.0000 12/3/2007
' AUTHOR	: Based on code by P. Charles, ADI
' Description 	: Script to uninstall McAfee AV components   
'
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
' EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
' WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
'
' Copyright (C) 2007.  Microsoft Corporation.  All rights reserved.
'
' NOTES		: ALL SAMPLE SCRIPTS BEGIN WITH THE SAME SETUP ELEMENTS
'                 You can use this script standalone or incoporate the 
'                 subroutines in this script into a larger script.
'
' HISTORY       : Version 2 - Fixed issue with ExecQuery error checking
'==============================================================================
Option Explicit
Dim bDEBUG : bDEBUG=True 'Set to TRUE to help with script debugging.
' Constants Declarations
  Const WAIT_ON_RETURN = True
  Const DO_NOT_WAIT_ON_RETURN = False
  Const HIDE_WINDOW = 0
  Const SHOW_WINDOW = 1
  Const ThisComputer = "."
'==============================================================================
' Main Routine
  On Error Resume Next
  If bDEBUG then On Error Goto 0
  
' Create system objects
  Dim WshShell      : Set WshShell = WScript.CreateObject("WScript.Shell")
  Dim objRegistry   : Set objRegistry = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" &_
			                            ThisComputer & "\root\default:StdRegProv")
  Dim objWMIService : Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
                                                     ThisComputer & "\root\cimv2")

' Call the installation functions
  'Call FCS_InstallXPSP2Hotfix
  Call UninstallMcAfeeAV

' Clean out the McAfee Quarantine folder
' NOTE: The location may vary depending on your installation
  On Error Resume Next
    WshShell.Run "erase /F /S /Q C:\VIRUS\*.*",HIDE_WINDOW,WAIT_ON_RETURN
  If bDEBUG Then On Error Goto 0
  
' Clean up objects and exit
  Set objWMIService = Nothing
  Set objRegistry = Nothing
  Set WshShell = Nothing
  
  wscript.quit
  
'=====================================================================================
' SubRoutine UninstallMcAfeeAV
'       This routine stops the McAfee framework services and uninstalls the AV client
'
'  INPUTS: None
'  OUTPUT: Logs MSI uninstall event
' ASSUMES: The existence of the WshShell, objRegistry, and objWMIService objects
'	   MsiExec.exe is in the directory the script was executed from or in the
'          file search PATH
'   NOTES: This script is set to uninstall McAfee Enterprise version 8
'          Other versions are included as well.
'          If your organization uses multiple versions you may want to use the
'          registry based uninstall routine.
'          
'======================================================================================
  Private Sub UninstallMcAfeeAV

    'Query for Services that are Dependents of the McAfee Framework Service
    Dim colServiceList, colServiceListCount, objService, errReturn
    Set colServiceList = objWMIService.ExecQuery("Associators of {Win32_Service.Name='McAfeeFramework'} Where " &_
	                                         "AssocClass=Win32_DependentService Role=Antecedent")

    'Detect a null return from an ExecQuery
    On Error Resume Next			'Accessing a NULL collection always generates an error
    colServiceListCount = -1
    colServiceListCount = colServiceList.Count	'An error will leave the value set to -1 
    If bDEBUG Then On Error Goto 0
    
    'Stop them
    If colServiceListCount >=0 Then	
  
  If bDEBUG then wscript.echo "DEBUG: Stopping McAfee AV Framework dependent services"
  	For Each objService In colServiceList
	    objService.StopService()
	    wscript.echo objService.Name & "." & objService.Status
  	Next
	Wscript.Sleep 20000
  
  	'Query for the Framework Service
  	Set colServiceList = objWMIService.ExecQuery("Select * from Win32_Service where Name='McAfeeFramework'")
        
        'Detect a null return from an ExecQuery
        On Error Resume Next			    'Accessing a NULL collection always generates an error
        colServiceListCount = -1
        colServiceListCount = colServiceList.Count  'An error will leave the value set to -1 
        If bDEBUG Then On Error Goto 0
 
  	
	If colServiceListCount >= 0 Then
  
  If bDEBUG then wscript.echo "DEBUG: Stopping McAfee AV Framework service"
  		For Each objService In colServiceList
			errReturn = objService.StopService()
  		Next
		Wscript.Sleep 10000  


  If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee AV Framework"
		On Error Resume Next
		' Uninstall McAfee AV Framework
  		WshShell.Run """C:\Program Files\Network Associates\Common Framework\FrmInst.exe"" /forceuninstall /Silent",HIDE_WINDOW,WAIT_ON_RETURN
 		WshShell.LogEvent 4, "Uninstalled McAfee AV Framework"
  		
  If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee VirusScan client"
   		' Uninstall McAfee AV Client
  		' McAfee VirusScan Enterprise 8.6
  		WshShell.Run"MsiExec /X{35C03C04-3F1F-42C2-A989-A757EE691F65} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
 		'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i"
 
 		' McAfee VirusScan Enterprise 8.0i
  		'WshShell.Run"MsiExec /X{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
 		'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i"

		' McAfee VirusScan Enterprise 7.1
  		'WshShell.Run"MsiExec /X{59224777-298D-4E9C-9AEB-4A91BDA01B27} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
 		'WshShell.LogEvent 4, "McAfee VirusScan Enterprise 7.1"

		' McAfee VirusScan Enterprise 7.0		
		'WshShell.Run"MsiExec /X{1912F734-6580-4620-8AFD-ECCCEA19CDE2} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
 		'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 7.0"

		' McAfee VirusScan MultiPlatform 4.5.1		
		'WshShell.Run "MsiExec /X{87AEFD84-BC0D-11D4-B885-00508B022A51} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
 		'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan MultiPlatform 4.5.1"
                If bDEBUG Then On Error Goto 0

  		' --> Alternate Uninstall method
  		' This method appears to work find for versions above 8.0
  		'Call RegBasedUninstall("McAfee VirusScan")
  	
  	ElseIf bDEBUG Then
  		wscript.echo "No McAfee Framework dependent services found."
  	End If
    ElseIf bDEBUG Then
  	wscript.echo "No McAfee Framework service found."
    End If
End Sub

'=====================================================================================
' SubRoutine RegBasedUninstall
'       This routine uninstall applications using the parameters supplied in the 
'       SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key
'       
'  INPUTS: The display name of the application to be uninstalled
'  OUTPUT: Logs MSI uninstall events
' ASSUMES: The existence of the WshShell and objRegistry objects
'          MsiExec.exe is in the directory the script was executed from or in the
'          file search PATH
'
' READ THESE NOTES!
'   NOTES: This script fairly generic and can be used to uninstall any product
'          if you know the display name string. HOWEVER it assumes the use of MSI for all
'          uninstalls.  If the application does not use MSI the routine will fail.

' CAUTION: This routine uses the InStr() function to locate the input display name in the 
'          registry display name. It does not do a direct match.  Since all enterprise 
'          versions of McAfee contain "McAfee VirusScan" in the display name this routine will
'          find and uninstall multiple versions of the AV client.
'          
'          HOWEVER passing a poorly formed parameter to this routine could have some
'          very bad unintended consequences. For example, if you pass the letter a to this
'          routine it will uninstall every product on the system with an "a" in the name!
'          
'======================================================================================
Sub RegBasedUninstall(InputDisplayName)

   
   Const HKEY_LOCAL_MACHINE = &H80000002
   Const UninstallRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
  
   Dim SubKeyArray, SubKey, DisplayName, UninstallString, StartPtr
   objRegistry.EnumKey HKEY_LOCAL_MACHINE, UninstallRegKey, SubKeyArray
 
   For Each SubKey In SubKeyArray
 	'Get the Display Name for this product
 	objRegistry.GetStringValue HKEY_LOCAL_MACHINE, UninstallRegKey & "\" & SubKey, "DisplayName", DisplayName

If bDEBUG Then wscript.echo "DEBUG: Uninstall Display name is: " & DisplayName

   	If Instr(DisplayName, InputDisplayName) > 0 Then 
		' Add the automatic, silent and no reboot MSI uninstall options
		objRegistry.GetStringValue HKEY_LOCAL_MACHINE, _
 			UninstallRegKey & "\" & SubKey, "UninstallString", UninstallString
 		
 		StartPtr = Instr(1,UninstallString,"/I") + 2
 		If StartPtr > 2 Then
 		   UninstallString = "MsiExec /X " & mid(UninstallString, StartPtr, 38) &_
 		                     " /q Reboot=""ReallySuppress"""
 		
 		Else
 		   UninstallString = UninstallString & " /q Reboot=""ReallySuppress"""
 		End If

If bDEBUG Then wscript.echo "DEBUG: Uninstall string is: " & UninstallString

' 		WshShell.Run UninstallString,HIDE_WINDOW,WAIT_ON_RETURN
 		WshShell.LogEvent 4, "Uninstalled " & DisplayName
 	End if
 	
   Next
End Sub